diff --git a/.isu/issues.json b/.isu/issues.json
index d877918..062441e 100644
--- a/.isu/issues.json
+++ b/.isu/issues.json
@@ -2861,7 +2861,7 @@
       ],
       "assigned": [],
       "author": "piefev",
-      "state": "open",
+      "state": "closed",
       "created_at": "2026-05-17T18:30:59Z"
     },
     {
diff --git a/crates/e2e/pages/29_script_with_lt.html b/crates/e2e/pages/29_script_with_lt.html
new file mode 100644
index 0000000..5dc4f0d
--- /dev/null
+++ b/crates/e2e/pages/29_script_with_lt.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+  body { font-family: sans-serif; padding: 20px; background: #fff; color: #111; }
+  #out { padding: 12px; background: #efe; border: 1px solid #6b6; }
+</style>
+</head>
+<body>
+  <h1>Inline script with &lt; characters</h1>
+  <div id="out">pending</div>
+  <script>
+    // Regression for x.com (isu issue 238): minified bundles routinely
+    // contain `<` in expressions like `for(var [a,r,n]=d[t],i=0,l=0;l<a.length;l++)`.
+    // Without the HTML script-data tokenizer state, the `<` was misread
+    // as the start of a new tag, the rest of the script was discarded,
+    // and parsing failed downstream ("expected Semicolon, found RParen").
+    var d = [[10, 20, 30], [40, 50, 60]];
+    var rows = [];
+    for (var t = 0; t < d.length; t++) {
+      for (var [a, r, n] = d[t], i = !0, l = 0; l < 3; l++) {
+        rows.push(a + ":" + r + ":" + n + ":" + i + ":" + l);
+      }
+    }
+    document.getElementById("out").textContent = rows.join(" | ");
+    console.log("script-with-lt ok: " + rows.length + " rows");
+  </script>
+</body>
+</html>
diff --git a/crates/e2e/scenarios/smoke.we b/crates/e2e/scenarios/smoke.we
index 5bdc975..b8a6c1a 100644
--- a/crates/e2e/scenarios/smoke.we
+++ b/crates/e2e/scenarios/smoke.we
@@ -78,3 +78,10 @@ dump_dom 28_new_member_chain.dom.txt
 dump_console 28_new_member_chain.console.txt
 assert_dom_contains "msg=oops; type=bad; arr=9"
 assert_console_contains "new-member-chain ok"
+
+goto crates/e2e/pages/29_script_with_lt.html
+screenshot 29_script_with_lt.png
+dump_dom 29_script_with_lt.dom.txt
+dump_console 29_script_with_lt.console.txt
+assert_dom_contains "10:20:30:true:0 | 10:20:30:true:1"
+assert_console_contains "script-with-lt ok: 6 rows"
diff --git a/crates/html/src/lib.rs b/crates/html/src/lib.rs
index d0adbae..7c6351e 100644
--- a/crates/html/src/lib.rs
+++ b/crates/html/src/lib.rs
@@ -46,6 +46,19 @@ pub fn tokenize(input: &str) -> Vec<Token> {
     let mut tokens = Vec::new();
     loop {
         let token = tok.next_token();
+        if let Token::StartTag { name, .. } = &token {
+            // Mirror tree-construction state switching so script/style/title
+            // content tokenizes correctly when the caller drives the
+            // tokenizer through this convenience wrapper.
+            match name.as_str() {
+                "script" => tok.switch_to_script_data(),
+                "style" | "iframe" | "xmp" | "noembed" | "noframes" | "noscript" => {
+                    tok.switch_to_rawtext();
+                }
+                "title" | "textarea" => tok.switch_to_rcdata(),
+                _ => {}
+            }
+        }
         match token {
             Token::Eof => break,
             Token::Character(ref s) => {
diff --git a/crates/html/src/speculative.rs b/crates/html/src/speculative.rs
index d6c57aa..1f87cd4 100644
--- a/crates/html/src/speculative.rs
+++ b/crates/html/src/speculative.rs
@@ -140,12 +140,25 @@ impl PreloadScanner {
         // Run the preload scan.
         let preloads = self.scan();
 
-        // Run the full tokenizer to buffer tokens.
+        // Run the full tokenizer to buffer tokens. Mirror the tree-builder
+        // state-switch logic so RCDATA/RAWTEXT/script-data content is
+        // tokenized correctly (e.g. `<` inside `<script>` is data, not a
+        // tag start).
         let input_str: String = self.input.iter().collect();
         let mut tokenizer = crate::Tokenizer::new(&input_str);
         let mut tokens = Vec::new();
         loop {
             let token = tokenizer.next_token();
+            if let Token::StartTag { name, .. } = &token {
+                match name.as_str() {
+                    "script" => tokenizer.switch_to_script_data(),
+                    "style" | "iframe" | "xmp" | "noembed" | "noframes" | "noscript" => {
+                        tokenizer.switch_to_rawtext();
+                    }
+                    "title" | "textarea" => tokenizer.switch_to_rcdata(),
+                    _ => {}
+                }
+            }
             if token == Token::Eof {
                 break;
             }
diff --git a/crates/html/src/tokenizer.rs b/crates/html/src/tokenizer.rs
index 29d6aa7..afa2398 100644
--- a/crates/html/src/tokenizer.rs
+++ b/crates/html/src/tokenizer.rs
@@ -54,6 +54,39 @@ enum State {
     DecCharacterReference,
     NumericCharacterReferenceEnd,
     NamedCharacterReference,
+    // Script data (§13.2.5.4 et seq.). Used inside <script> elements; only
+    // `</script>` matching the appropriate end tag returns to Data state.
+    ScriptData,
+    ScriptDataLessThanSign,
+    ScriptDataEndTagOpen,
+    ScriptDataEndTagName,
+    ScriptDataEscapeStart,
+    ScriptDataEscapeStartDash,
+    ScriptDataEscaped,
+    ScriptDataEscapedDash,
+    ScriptDataEscapedDashDash,
+    ScriptDataEscapedLessThanSign,
+    ScriptDataEscapedEndTagOpen,
+    ScriptDataEscapedEndTagName,
+    ScriptDataDoubleEscapeStart,
+    ScriptDataDoubleEscaped,
+    ScriptDataDoubleEscapedDash,
+    ScriptDataDoubleEscapedDashDash,
+    ScriptDataDoubleEscapedLessThanSign,
+    ScriptDataDoubleEscapeEnd,
+    // RAWTEXT (§13.2.5.3 et seq.). Used inside <style>, <iframe>, <xmp>,
+    // <noembed>, <noframes>; data treated literally except for the
+    // appropriate end tag.
+    Rawtext,
+    RawtextLessThanSign,
+    RawtextEndTagOpen,
+    RawtextEndTagName,
+    // RCDATA (§13.2.5.2 et seq.). Used inside <title>, <textarea>; like
+    // RAWTEXT but resolves character references.
+    Rcdata,
+    RcdataLessThanSign,
+    RcdataEndTagOpen,
+    RcdataEndTagName,
 }
 
 fn is_html_whitespace(ch: char) -> bool {
@@ -137,6 +170,11 @@ pub struct Tokenizer {
     char_ref_code: u32,
     temp_buf: String,
     parse_errors: Vec<ParseError>,
+    /// The name of the most recently emitted start tag. Used by RCDATA,
+    /// RAWTEXT, and script-data states to recognize the "appropriate end
+    /// tag" — only an end tag whose name equals this aborts the special
+    /// state and switches back to Data.
+    last_start_tag_name: Option<String>,
 }
 
 impl Tokenizer {
@@ -162,9 +200,38 @@ impl Tokenizer {
             char_ref_code: 0,
             temp_buf: String::new(),
             parse_errors: Vec::new(),
+            last_start_tag_name: None,
         }
     }
 
+    /// Switch the tokenizer to the script-data state.
+    ///
+    /// Per HTML5 §13.2.6.4 (in head insertion mode), the tree builder calls
+    /// this after emitting a `<script>` start tag so that the tokenizer
+    /// treats subsequent input as script data until a matching `</script>`
+    /// is seen.
+    pub fn switch_to_script_data(&mut self) {
+        self.state = State::ScriptData;
+    }
+
+    /// Switch the tokenizer to the RAWTEXT state.
+    ///
+    /// Called by the tree builder after emitting a start tag whose
+    /// associated text content uses RAWTEXT rules (`<style>`, `<iframe>`,
+    /// `<xmp>`, `<noembed>`, `<noframes>`, and `<noscript>` when scripting
+    /// is enabled).
+    pub fn switch_to_rawtext(&mut self) {
+        self.state = State::Rawtext;
+    }
+
+    /// Switch the tokenizer to the RCDATA state.
+    ///
+    /// Called by the tree builder after emitting a start tag whose
+    /// associated text content uses RCDATA rules (`<title>`, `<textarea>`).
+    pub fn switch_to_rcdata(&mut self) {
+        self.state = State::Rcdata;
+    }
+
     /// Return parse errors collected so far.
     pub fn parse_errors(&self) -> &[ParseError] {
         &self.parse_errors
@@ -225,6 +292,7 @@ impl Tokenizer {
                 name: self.tag_name.clone(),
             });
         } else {
+            self.last_start_tag_name = Some(self.tag_name.clone());
             self.emit(Token::StartTag {
                 name: self.tag_name.clone(),
                 attributes: self.tag_attributes.clone(),
@@ -233,6 +301,32 @@ impl Tokenizer {
         }
     }
 
+    /// Is the current tag (an end tag) the "appropriate end tag" — i.e.
+    /// its name matches the most recently emitted start tag's name? Used
+    /// by RCDATA/RAWTEXT/script-data states to decide whether a `</tag>`
+    /// terminates the special parsing mode or is treated as literal data.
+    fn current_end_tag_is_appropriate(&self) -> bool {
+        match &self.last_start_tag_name {
+            Some(last) => *last == self.tag_name,
+            None => false,
+        }
+    }
+
+    /// Emit the buffered tag-name characters as literal Character tokens,
+    /// preceded by `<` and (optionally) `/`. Used when an RCDATA/RAWTEXT/
+    /// script-data end-tag candidate turns out not to be an appropriate
+    /// end tag and must be re-emitted as character data.
+    fn emit_temp_as_chars(&mut self, leading_slash: bool) {
+        self.emit_char('<');
+        if leading_slash {
+            self.emit_char('/');
+        }
+        let buf = std::mem::take(&mut self.temp_buf);
+        for ch in buf.chars() {
+            self.emit_char(ch);
+        }
+    }
+
     fn emit_current_comment(&mut self) {
         self.emit(Token::Comment(self.comment_data.clone()));
     }
@@ -363,6 +457,36 @@ impl Tokenizer {
             State::DecCharacterReference => self.state_dec_character_reference(),
             State::NumericCharacterReferenceEnd => self.state_numeric_character_reference_end(),
             State::NamedCharacterReference => self.state_named_character_reference(),
+            State::ScriptData => self.state_script_data(),
+            State::ScriptDataLessThanSign => self.state_script_data_less_than_sign(),
+            State::ScriptDataEndTagOpen => self.state_script_data_end_tag_open(),
+            State::ScriptDataEndTagName => self.state_script_data_end_tag_name(),
+            State::ScriptDataEscapeStart => self.state_script_data_escape_start(),
+            State::ScriptDataEscapeStartDash => self.state_script_data_escape_start_dash(),
+            State::ScriptDataEscaped => self.state_script_data_escaped(),
+            State::ScriptDataEscapedDash => self.state_script_data_escaped_dash(),
+            State::ScriptDataEscapedDashDash => self.state_script_data_escaped_dash_dash(),
+            State::ScriptDataEscapedLessThanSign => self.state_script_data_escaped_less_than_sign(),
+            State::ScriptDataEscapedEndTagOpen => self.state_script_data_escaped_end_tag_open(),
+            State::ScriptDataEscapedEndTagName => self.state_script_data_escaped_end_tag_name(),
+            State::ScriptDataDoubleEscapeStart => self.state_script_data_double_escape_start(),
+            State::ScriptDataDoubleEscaped => self.state_script_data_double_escaped(),
+            State::ScriptDataDoubleEscapedDash => self.state_script_data_double_escaped_dash(),
+            State::ScriptDataDoubleEscapedDashDash => {
+                self.state_script_data_double_escaped_dash_dash()
+            }
+            State::ScriptDataDoubleEscapedLessThanSign => {
+                self.state_script_data_double_escaped_less_than_sign()
+            }
+            State::ScriptDataDoubleEscapeEnd => self.state_script_data_double_escape_end(),
+            State::Rawtext => self.state_rawtext(),
+            State::RawtextLessThanSign => self.state_rawtext_less_than_sign(),
+            State::RawtextEndTagOpen => self.state_rawtext_end_tag_open(),
+            State::RawtextEndTagName => self.state_rawtext_end_tag_name(),
+            State::Rcdata => self.state_rcdata(),
+            State::RcdataLessThanSign => self.state_rcdata_less_than_sign(),
+            State::RcdataEndTagOpen => self.state_rcdata_end_tag_open(),
+            State::RcdataEndTagName => self.state_rcdata_end_tag_name(),
         }
     }
 
@@ -1904,6 +2028,516 @@ impl Tokenizer {
         }
         true
     }
+
+    // ── Script data states (§13.2.5.4 et seq.) ───────────────────────────
+    //
+    // Inside `<script>`, the input is treated as opaque text until a
+    // matching `</script>` end tag is seen. The escape-start/escaped/
+    // double-escape states implement the legacy `<!-- ... -->` carve-out
+    // that lets scripts contain HTML-comment-like markup without breaking
+    // tokenization.
+
+    fn state_script_data(&mut self) {
+        match self.next_char() {
+            Some('<') => {
+                self.state = State::ScriptDataLessThanSign;
+            }
+            Some('\0') => {
+                self.parse_error("unexpected-null-character");
+                self.emit_char('\u{FFFD}');
+            }
+            None => {
+                self.emit_eof();
+            }
+            Some(c) => {
+                self.emit_char(c);
+            }
+        }
+    }
+
+    fn state_script_data_less_than_sign(&mut self) {
+        match self.next_char() {
+            Some('/') => {
+                self.temp_buf.clear();
+                self.state = State::ScriptDataEndTagOpen;
+            }
+            Some('!') => {
+                self.emit_char('<');
+                self.emit_char('!');
+                self.state = State::ScriptDataEscapeStart;
+            }
+            _ => {
+                self.emit_char('<');
+                self.reconsume();
+                self.state = State::ScriptData;
+            }
+        }
+    }
+
+    fn state_script_data_end_tag_open(&mut self) {
+        match self.peek_char() {
+            Some(c) if c.is_ascii_alphabetic() => {
+                self.start_new_tag(true);
+                self.state = State::ScriptDataEndTagName;
+            }
+            _ => {
+                self.emit_char('<');
+                self.emit_char('/');
+                self.state = State::ScriptData;
+            }
+        }
+    }
+
+    fn state_script_data_end_tag_name(&mut self) {
+        match self.next_char() {
+            Some(c) if is_html_whitespace(c) && self.current_end_tag_is_appropriate() => {
+                self.state = State::BeforeAttributeName;
+            }
+            Some('/') if self.current_end_tag_is_appropriate() => {
+                self.state = State::SelfClosingStartTag;
+            }
+            Some('>') if self.current_end_tag_is_appropriate() => {
+                self.state = State::Data;
+                self.emit_current_tag();
+            }
+            Some(c) if c.is_ascii_alphabetic() => {
+                self.tag_name.push(c.to_ascii_lowercase());
+                self.temp_buf.push(c);
+            }
+            _ => {
+                self.emit_temp_as_chars(true);
+                self.reconsume();
+                self.state = State::ScriptData;
+            }
+        }
+    }
+
+    fn state_script_data_escape_start(&mut self) {
+        if self.peek_char() == Some('-') {
+            self.next_char();
+            self.emit_char('-');
+            self.state = State::ScriptDataEscapeStartDash;
+        } else {
+            self.state = State::ScriptData;
+        }
+    }
+
+    fn state_script_data_escape_start_dash(&mut self) {
+        if self.peek_char() == Some('-') {
+            self.next_char();
+            self.emit_char('-');
+            self.state = State::ScriptDataEscapedDashDash;
+        } else {
+            self.state = State::ScriptData;
+        }
+    }
+
+    fn state_script_data_escaped(&mut self) {
+        match self.next_char() {
+            Some('-') => {
+                self.emit_char('-');
+                self.state = State::ScriptDataEscapedDash;
+            }
+            Some('<') => {
+                self.state = State::ScriptDataEscapedLessThanSign;
+            }
+            Some('\0') => {
+                self.parse_error("unexpected-null-character");
+                self.emit_char('\u{FFFD}');
+            }
+            None => {
+                self.parse_error("eof-in-script-html-comment-like-text");
+                self.emit_eof();
+            }
+            Some(c) => {
+                self.emit_char(c);
+            }
+        }
+    }
+
+    fn state_script_data_escaped_dash(&mut self) {
+        match self.next_char() {
+            Some('-') => {
+                self.emit_char('-');
+                self.state = State::ScriptDataEscapedDashDash;
+            }
+            Some('<') => {
+                self.state = State::ScriptDataEscapedLessThanSign;
+            }
+            Some('\0') => {
+                self.parse_error("unexpected-null-character");
+                self.emit_char('\u{FFFD}');
+                self.state = State::ScriptDataEscaped;
+            }
+            None => {
+                self.parse_error("eof-in-script-html-comment-like-text");
+                self.emit_eof();
+            }
+            Some(c) => {
+                self.emit_char(c);
+                self.state = State::ScriptDataEscaped;
+            }
+        }
+    }
+
+    fn state_script_data_escaped_dash_dash(&mut self) {
+        match self.next_char() {
+            Some('-') => {
+                self.emit_char('-');
+            }
+            Some('<') => {
+                self.state = State::ScriptDataEscapedLessThanSign;
+            }
+            Some('>') => {
+                self.emit_char('>');
+                self.state = State::ScriptData;
+            }
+            Some('\0') => {
+                self.parse_error("unexpected-null-character");
+                self.emit_char('\u{FFFD}');
+                self.state = State::ScriptDataEscaped;
+            }
+            None => {
+                self.parse_error("eof-in-script-html-comment-like-text");
+                self.emit_eof();
+            }
+            Some(c) => {
+                self.emit_char(c);
+                self.state = State::ScriptDataEscaped;
+            }
+        }
+    }
+
+    fn state_script_data_escaped_less_than_sign(&mut self) {
+        match self.peek_char() {
+            Some('/') => {
+                self.next_char();
+                self.temp_buf.clear();
+                self.state = State::ScriptDataEscapedEndTagOpen;
+            }
+            Some(c) if c.is_ascii_alphabetic() => {
+                self.temp_buf.clear();
+                self.emit_char('<');
+                self.state = State::ScriptDataDoubleEscapeStart;
+            }
+            _ => {
+                self.emit_char('<');
+                self.state = State::ScriptDataEscaped;
+            }
+        }
+    }
+
+    fn state_script_data_escaped_end_tag_open(&mut self) {
+        match self.peek_char() {
+            Some(c) if c.is_ascii_alphabetic() => {
+                self.start_new_tag(true);
+                self.state = State::ScriptDataEscapedEndTagName;
+            }
+            _ => {
+                self.emit_char('<');
+                self.emit_char('/');
+                self.state = State::ScriptDataEscaped;
+            }
+        }
+    }
+
+    fn state_script_data_escaped_end_tag_name(&mut self) {
+        match self.next_char() {
+            Some(c) if is_html_whitespace(c) && self.current_end_tag_is_appropriate() => {
+                self.state = State::BeforeAttributeName;
+            }
+            Some('/') if self.current_end_tag_is_appropriate() => {
+                self.state = State::SelfClosingStartTag;
+            }
+            Some('>') if self.current_end_tag_is_appropriate() => {
+                self.state = State::Data;
+                self.emit_current_tag();
+            }
+            Some(c) if c.is_ascii_alphabetic() => {
+                self.tag_name.push(c.to_ascii_lowercase());
+                self.temp_buf.push(c);
+            }
+            _ => {
+                self.emit_temp_as_chars(true);
+                self.reconsume();
+                self.state = State::ScriptDataEscaped;
+            }
+        }
+    }
+
+    fn state_script_data_double_escape_start(&mut self) {
+        match self.next_char() {
+            Some(c) if is_html_whitespace(c) || c == '/' || c == '>' => {
+                self.emit_char(c);
+                if self.temp_buf.eq_ignore_ascii_case("script") {
+                    self.state = State::ScriptDataDoubleEscaped;
+                } else {
+                    self.state = State::ScriptDataEscaped;
+                }
+            }
+            Some(c) if c.is_ascii_alphabetic() => {
+                self.temp_buf.push(c.to_ascii_lowercase());
+                self.emit_char(c);
+            }
+            _ => {
+                self.reconsume();
+                self.state = State::ScriptDataEscaped;
+            }
+        }
+    }
+
+    fn state_script_data_double_escaped(&mut self) {
+        match self.next_char() {
+            Some('-') => {
+                self.emit_char('-');
+                self.state = State::ScriptDataDoubleEscapedDash;
+            }
+            Some('<') => {
+                self.emit_char('<');
+                self.state = State::ScriptDataDoubleEscapedLessThanSign;
+            }
+            Some('\0') => {
+                self.parse_error("unexpected-null-character");
+                self.emit_char('\u{FFFD}');
+            }
+            None => {
+                self.parse_error("eof-in-script-html-comment-like-text");
+                self.emit_eof();
+            }
+            Some(c) => {
+                self.emit_char(c);
+            }
+        }
+    }
+
+    fn state_script_data_double_escaped_dash(&mut self) {
+        match self.next_char() {
+            Some('-') => {
+                self.emit_char('-');
+                self.state = State::ScriptDataDoubleEscapedDashDash;
+            }
+            Some('<') => {
+                self.emit_char('<');
+                self.state = State::ScriptDataDoubleEscapedLessThanSign;
+            }
+            Some('\0') => {
+                self.parse_error("unexpected-null-character");
+                self.emit_char('\u{FFFD}');
+                self.state = State::ScriptDataDoubleEscaped;
+            }
+            None => {
+                self.parse_error("eof-in-script-html-comment-like-text");
+                self.emit_eof();
+            }
+            Some(c) => {
+                self.emit_char(c);
+                self.state = State::ScriptDataDoubleEscaped;
+            }
+        }
+    }
+
+    fn state_script_data_double_escaped_dash_dash(&mut self) {
+        match self.next_char() {
+            Some('-') => {
+                self.emit_char('-');
+            }
+            Some('<') => {
+                self.emit_char('<');
+                self.state = State::ScriptDataDoubleEscapedLessThanSign;
+            }
+            Some('>') => {
+                self.emit_char('>');
+                self.state = State::ScriptData;
+            }
+            Some('\0') => {
+                self.parse_error("unexpected-null-character");
+                self.emit_char('\u{FFFD}');
+                self.state = State::ScriptDataDoubleEscaped;
+            }
+            None => {
+                self.parse_error("eof-in-script-html-comment-like-text");
+                self.emit_eof();
+            }
+            Some(c) => {
+                self.emit_char(c);
+                self.state = State::ScriptDataDoubleEscaped;
+            }
+        }
+    }
+
+    fn state_script_data_double_escaped_less_than_sign(&mut self) {
+        if self.peek_char() == Some('/') {
+            self.next_char();
+            self.temp_buf.clear();
+            self.emit_char('/');
+            self.state = State::ScriptDataDoubleEscapeEnd;
+        } else {
+            self.state = State::ScriptDataDoubleEscaped;
+        }
+    }
+
+    fn state_script_data_double_escape_end(&mut self) {
+        match self.next_char() {
+            Some(c) if is_html_whitespace(c) || c == '/' || c == '>' => {
+                self.emit_char(c);
+                if self.temp_buf.eq_ignore_ascii_case("script") {
+                    self.state = State::ScriptDataEscaped;
+                } else {
+                    self.state = State::ScriptDataDoubleEscaped;
+                }
+            }
+            Some(c) if c.is_ascii_alphabetic() => {
+                self.temp_buf.push(c.to_ascii_lowercase());
+                self.emit_char(c);
+            }
+            _ => {
+                self.reconsume();
+                self.state = State::ScriptDataDoubleEscaped;
+            }
+        }
+    }
+
+    // ── RAWTEXT states (§13.2.5.3 et seq.) ───────────────────────────────
+
+    fn state_rawtext(&mut self) {
+        match self.next_char() {
+            Some('<') => {
+                self.state = State::RawtextLessThanSign;
+            }
+            Some('\0') => {
+                self.parse_error("unexpected-null-character");
+                self.emit_char('\u{FFFD}');
+            }
+            None => {
+                self.emit_eof();
+            }
+            Some(c) => {
+                self.emit_char(c);
+            }
+        }
+    }
+
+    fn state_rawtext_less_than_sign(&mut self) {
+        if self.peek_char() == Some('/') {
+            self.next_char();
+            self.temp_buf.clear();
+            self.state = State::RawtextEndTagOpen;
+        } else {
+            self.emit_char('<');
+            self.state = State::Rawtext;
+        }
+    }
+
+    fn state_rawtext_end_tag_open(&mut self) {
+        match self.peek_char() {
+            Some(c) if c.is_ascii_alphabetic() => {
+                self.start_new_tag(true);
+                self.state = State::RawtextEndTagName;
+            }
+            _ => {
+                self.emit_char('<');
+                self.emit_char('/');
+                self.state = State::Rawtext;
+            }
+        }
+    }
+
+    fn state_rawtext_end_tag_name(&mut self) {
+        match self.next_char() {
+            Some(c) if is_html_whitespace(c) && self.current_end_tag_is_appropriate() => {
+                self.state = State::BeforeAttributeName;
+            }
+            Some('/') if self.current_end_tag_is_appropriate() => {
+                self.state = State::SelfClosingStartTag;
+            }
+            Some('>') if self.current_end_tag_is_appropriate() => {
+                self.state = State::Data;
+                self.emit_current_tag();
+            }
+            Some(c) if c.is_ascii_alphabetic() => {
+                self.tag_name.push(c.to_ascii_lowercase());
+                self.temp_buf.push(c);
+            }
+            _ => {
+                self.emit_temp_as_chars(true);
+                self.reconsume();
+                self.state = State::Rawtext;
+            }
+        }
+    }
+
+    // ── RCDATA states (§13.2.5.2 et seq.) ────────────────────────────────
+
+    fn state_rcdata(&mut self) {
+        match self.next_char() {
+            Some('&') => {
+                self.return_state = State::Rcdata;
+                self.state = State::CharacterReference;
+            }
+            Some('<') => {
+                self.state = State::RcdataLessThanSign;
+            }
+            Some('\0') => {
+                self.parse_error("unexpected-null-character");
+                self.emit_char('\u{FFFD}');
+            }
+            None => {
+                self.emit_eof();
+            }
+            Some(c) => {
+                self.emit_char(c);
+            }
+        }
+    }
+
+    fn state_rcdata_less_than_sign(&mut self) {
+        if self.peek_char() == Some('/') {
+            self.next_char();
+            self.temp_buf.clear();
+            self.state = State::RcdataEndTagOpen;
+        } else {
+            self.emit_char('<');
+            self.state = State::Rcdata;
+        }
+    }
+
+    fn state_rcdata_end_tag_open(&mut self) {
+        match self.peek_char() {
+            Some(c) if c.is_ascii_alphabetic() => {
+                self.start_new_tag(true);
+                self.state = State::RcdataEndTagName;
+            }
+            _ => {
+                self.emit_char('<');
+                self.emit_char('/');
+                self.state = State::Rcdata;
+            }
+        }
+    }
+
+    fn state_rcdata_end_tag_name(&mut self) {
+        match self.next_char() {
+            Some(c) if is_html_whitespace(c) && self.current_end_tag_is_appropriate() => {
+                self.state = State::BeforeAttributeName;
+            }
+            Some('/') if self.current_end_tag_is_appropriate() => {
+                self.state = State::SelfClosingStartTag;
+            }
+            Some('>') if self.current_end_tag_is_appropriate() => {
+                self.state = State::Data;
+                self.emit_current_tag();
+            }
+            Some(c) if c.is_ascii_alphabetic() => {
+                self.tag_name.push(c.to_ascii_lowercase());
+                self.temp_buf.push(c);
+            }
+            _ => {
+                self.emit_temp_as_chars(true);
+                self.reconsume();
+                self.state = State::Rcdata;
+            }
+        }
+    }
 }
 
 #[cfg(test)]
@@ -2406,4 +3040,131 @@ mod tests {
         assert_eq!(tokenizer.next_token(), Token::Eof);
         assert_eq!(tokenizer.parse_errors()[0].message, "eof-in-comment");
     }
+
+    // ── Script data / RAWTEXT / RCDATA state regression tests ────────────
+    //
+    // Real-world JS bundles routinely contain `<` characters (e.g. the
+    // minified `for(var [a,r,n]=d[t],i=!0,l=0;l<a.length;l++)` pattern
+    // observed on x.com). Without the script-data state, the tokenizer
+    // treated those as the start of a new tag and corrupted the script
+    // source, producing downstream JS parse failures. Same idea for
+    // `<style>` (RAWTEXT) and `<title>`/`<textarea>` (RCDATA).
+
+    #[test]
+    fn script_data_treats_lt_inside_script_as_text() {
+        let tokens = tokenize("<script>for(var t=0;t<d.length;t++){}</script>");
+        assert_eq!(
+            tokens,
+            vec![
+                Token::StartTag {
+                    name: "script".to_string(),
+                    attributes: vec![],
+                    self_closing: false,
+                },
+                Token::Character("for(var t=0;t<d.length;t++){}".to_string()),
+                Token::EndTag {
+                    name: "script".to_string(),
+                },
+            ]
+        );
+    }
+
+    #[test]
+    fn script_data_lt_followed_by_unrelated_end_tag_is_text() {
+        // `</p>` inside a script must not close the script.
+        let tokens = tokenize("<script>a</p>b</script>");
+        assert_eq!(
+            tokens,
+            vec![
+                Token::StartTag {
+                    name: "script".to_string(),
+                    attributes: vec![],
+                    self_closing: false,
+                },
+                Token::Character("a</p>b".to_string()),
+                Token::EndTag {
+                    name: "script".to_string(),
+                },
+            ]
+        );
+    }
+
+    #[test]
+    fn script_data_case_insensitive_end_tag_match() {
+        let tokens = tokenize("<script>foo</SCRIPT>");
+        assert_eq!(
+            tokens,
+            vec![
+                Token::StartTag {
+                    name: "script".to_string(),
+                    attributes: vec![],
+                    self_closing: false,
+                },
+                Token::Character("foo".to_string()),
+                Token::EndTag {
+                    name: "script".to_string(),
+                },
+            ]
+        );
+    }
+
+    #[test]
+    fn script_data_escape_html_comment_inside_script() {
+        // `<!--` ... `-->` inside a script keeps the tokenizer in escape
+        // states; `</script>` still terminates because the appropriate
+        // end-tag check runs in those states too.
+        let tokens = tokenize("<script><!-- a<b --></script>");
+        assert_eq!(
+            tokens,
+            vec![
+                Token::StartTag {
+                    name: "script".to_string(),
+                    attributes: vec![],
+                    self_closing: false,
+                },
+                Token::Character("<!-- a<b -->".to_string()),
+                Token::EndTag {
+                    name: "script".to_string(),
+                },
+            ]
+        );
+    }
+
+    #[test]
+    fn rawtext_style_keeps_lt_as_text() {
+        let tokens = tokenize("<style>.a{content:'<'}</style>");
+        assert_eq!(
+            tokens,
+            vec![
+                Token::StartTag {
+                    name: "style".to_string(),
+                    attributes: vec![],
+                    self_closing: false,
+                },
+                Token::Character(".a{content:'<'}".to_string()),
+                Token::EndTag {
+                    name: "style".to_string(),
+                },
+            ]
+        );
+    }
+
+    #[test]
+    fn rcdata_title_keeps_lt_but_resolves_entities() {
+        let tokens = tokenize("<title>5 &lt; 7 &amp; ok</title>");
+        assert_eq!(
+            tokens,
+            vec![
+                Token::StartTag {
+                    name: "title".to_string(),
+                    attributes: vec![],
+                    self_closing: false,
+                },
+                Token::Character("5 < 7 & ok".to_string()),
+                Token::EndTag {
+                    name: "title".to_string(),
+                },
+            ]
+        );
+    }
 }
diff --git a/crates/html/src/tree_builder.rs b/crates/html/src/tree_builder.rs
index 0091e8d..986ff3f 100644
--- a/crates/html/src/tree_builder.rs
+++ b/crates/html/src/tree_builder.rs
@@ -1087,7 +1087,18 @@ pub fn parse_html(input: &str) -> Document {
     loop {
         let token = tokenizer.next_token();
         let is_eof = token == Token::Eof;
+        // Per HTML5 §13.2.6 the tree construction stage tells the tokenizer
+        // to switch states for elements whose content uses RCDATA, RAWTEXT,
+        // or script-data tokenization (so e.g. `<` inside a `<script>` is
+        // treated as data, not as the start of a tag).
+        let state_switch = match &token {
+            Token::StartTag { name, .. } => state_switch_for_start_tag(name),
+            _ => None,
+        };
         builder.process_token(token);
+        if let Some(switch) = state_switch {
+            switch(&mut tokenizer);
+        }
         if is_eof {
             break;
         }
@@ -1095,6 +1106,19 @@ pub fn parse_html(input: &str) -> Document {
     builder.finish()
 }
 
+fn state_switch_for_start_tag(name: &str) -> Option<fn(&mut Tokenizer)> {
+    match name {
+        "script" => Some(Tokenizer::switch_to_script_data),
+        // RAWTEXT elements (scripting-enabled `<noscript>` included).
+        "style" | "iframe" | "xmp" | "noembed" | "noframes" | "noscript" => {
+            Some(Tokenizer::switch_to_rawtext)
+        }
+        // RCDATA elements.
+        "title" | "textarea" => Some(Tokenizer::switch_to_rcdata),
+        _ => None,
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1829,4 +1853,37 @@ mod tests {
         // Select should be closed before input, making them siblings.
         assert_eq!(tags, vec!["select", "input"]);
     }
+
+    /// Regression test for x.com (isu issue 238): a `<script>` element whose
+    /// body contains `<` characters (e.g. `for(...;i<a.length;...)`) must
+    /// be captured verbatim. Before the script-data tokenizer state was
+    /// added, the `<` was misread as the start of a tag and the script
+    /// body was truncated, producing downstream JS parse failures.
+    #[test]
+    fn script_body_with_angle_brackets_preserved() {
+        let src = "<script>for(var t=0;t<a.length;t++){a[t]=t}</script>";
+        let doc = parse_html(src);
+        // Find the <script> element.
+        fn find_script(doc: &Document, node: NodeId) -> Option<NodeId> {
+            if let NodeData::Element { tag_name, .. } = doc.node_data(node) {
+                if tag_name == "script" {
+                    return Some(node);
+                }
+            }
+            for child in doc.children(node) {
+                if let Some(found) = find_script(doc, child) {
+                    return Some(found);
+                }
+            }
+            None
+        }
+        let script = find_script(&doc, doc.root()).expect("script in tree");
+        let mut text = String::new();
+        for child in doc.children(script) {
+            if let NodeData::Text { data } = doc.node_data(child) {
+                text.push_str(data);
+            }
+        }
+        assert_eq!(text, "for(var t=0;t<a.length;t++){a[t]=t}");
+    }
 }
